Swagger is the older branding and tooling ecosystem that preceded and later evolved into OpenAPI. In practice, people still use “Swagger” to refer to API specifications, documentation UIs, code generators, and related tooling that read or produce OpenAPI files.
It matters in cyber security because API specs are not just documentation; many tools parse them automatically and may feed their contents into generators, validators, or build pipelines. If a tool mishandles untrusted Swagger/OpenAPI input, attacker-controlled fields can become triggers for command injection, path traversal, or other parser bugs. Defenders should treat Swagger files as untrusted input, isolate spec-processing tools, avoid shell-based handling, and review generated artifacts and child processes during ingestion.